1.1 The clearing guarantee and the cash needed to perform it

A central counterparty becomes the buyer to each seller and the seller to each buyer under the applicable clearing agreement. Its guarantee places the contractual obligation to perform on the clearinghouse when a participant fails. The clearinghouse therefore needs resources to meet losses and cash available when payments fall due. This paper asks how those requirements change when selling a failed participant’s assets moves their price.

Consider the collateral-sale example developed in Section 6.5. An account owes 100 and has pledged assets quoted at 80. Those pledged assets are its collateral, available to meet the obligation subject to existing claims and priorities. Selling them yields 70 after price impact, so 30 remains unpaid. The quote suggested a 20 gap, but the sale itself added 10 to it. The clearinghouse must meet that remaining loss through other resources or a legally permitted reduction of claims. A reduction makes a creditor bear loss. It supplies no cash.

Timing creates another requirement even when total asset value is sufficient. In Example 6.7, a payment of 100 falls due at time 1. Available cash is 20, and securities produce another 80 only at time 2. The earlier payment still has a cash gap of 80. A timely facility can cover that gap, but its repayment must remain in the settlement plan. Appendix C computes the minimum initial cash that permits completion after every represented observation and deadline.

Margin is the collateral requirement imposed before losses occur. An account defaults in this paper’s clearing application when its current loss exceeds its available collateral. A default waterfall specifies the order in which the clearinghouse uses resources and reduces eligible claims after that default. Netting replaces specified gross obligations by their legally enforceable net amounts. Clearing here computes obligations and applies this waterfall within the clearing book. Settlement requires the resulting transfers to become final under the external payment system’s rules. The zero-residual theorem below states when the waterfall allocates the full loss, including any permitted claim reductions. The completion theorem states when an admitted payment plan has enough timely cash to perform its remaining obligations.

1.2 Why automated execution changes clearing risk

An automated market maker (AMM) exchanges assets held in a pool according to a specified reserve rule. A sale removes the asset used for payment and adds the asset being sold, changing the price of the next unit. The difference between the initial quoted price and the average execution price is slippage. Liquidity providers (LPs) supply these reserves and hold shares in the pool. Their withdrawals reduce the reserves available for later trades. We use central counterparty (CCP) for the clearinghouse.

The pools studied here exchange different assets against one common asset. We call the common asset the hub asset and each other asset a spoke asset. This arrangement connects otherwise separate pools through their common trading asset. If that asset also derives value from the liquidity locked in the pools, withdrawals can reduce collateral value and induce further withdrawals. We call this dependence endogenous value and the resulting price-withdrawal feedback reflexivity.

A second source of risk is an inaccurate model of losses occurring together. A collateralized debt obligation (CDO) divides a pool of debt into claims, called tranches, with different payment priorities. The historical comparison below concerns the dependence model used to value those claims. It does not treat their valuation as centrally cleared settlement.

Terra/Luna (May 2022) and Iron Finance (June 2021) collapsed through the same loop: the asset backing the system was valued partly by the liquidity locked in the system, so withdrawals cut the collateral value, which forced liquidations, which drove further withdrawals [14, 15, 17]. Own-token collateral creates the exchange-side instance of the same defect. In 2008, the pricing and rating of CDO tranches rested on a single Gaussian-copula correlation model [58] calibrated on a sample that contained no systemic default event; when the tail realised, the capital held against the senior tranches did not cover it [68, 69]. Two defects recur: collateral whose value is endogenous to the clearing system, and solvency resting on one correlation model.

A central counterparty (CCP) clearing trades executed on a hub-and-spoke AMM faces both defects in sharpened form, together with one structural advantage. The advantage: the price-impact function is deterministic and known to the clearinghouse. When a position is liquidated into an AMM pool with reserves (R_{\!M}, R_{\!B}), the realised slippage is a closed-form function of volume relative to reserves, not a distribution over an unobservable order-book state. The sharpened defect: if the hub asset’s valuation depends partly on liquidity locked in the spokes, the clearing and price-formation layers are coupled, and the feedback loop admits an exact dynamical-systems representation.

In this paper, clear means compute obligations and apply the waterfall inside the clearing book. It does not mean that an external settlement rail has made a final transfer.

AMM venues now clear leveraged derivatives without the margin methodology, waterfall design, and stress discipline of established CCP practice. Traditional CCP theory treats price impact stochastically (Standard Portfolio Analysis of Risk (SPAN) [7] shock scenarios applied to exogenous markets) and treats collateral value as independent of clearing decisions; neither assumption holds here. The Cont-Wagalath framework [4] for fire-sale contagion is the right starting point and requires specialisation to the AMM impact kernel; the Eisenberg-Noe framework [1] for network clearing is the natural comparison for the waterfall, which needs no fixed point once the losses entering it are fixed at clearing time; and the reflexive channel requires a model neither supplies.

Expected Shortfall (ES) is the average loss in a specified worst probability mass. At a tail mass of one percent, it averages the worst one percent of outcomes, taking the required fraction of any tied outcome. This measure helps size margin. A stated margin requirement still needs actual collateral funding. The waterfall can finally reduce unpaid profit claims through auto-deleveraging (ADL). These reductions are distinct from the cash resources collected at earlier stages.

The dynamics require a further distinction. A branch is a set of rates of change consistent with the simultaneous price and withdrawal equations. An impasse is a state where those equations lose the ability to determine a finite rate. A fold bifurcation would instead describe equilibria meeting and disappearing as a parameter changes. The classification below determines which of these mechanisms the model actually supports.

1.3 Contributions and adapted material

A settlement asset is the asset used to discharge obligations. A depeg is a deviation from its reference value. The loss bounds below consider downward deviations. A haircut credits collateral below its reference value to allow for deterioration and conversion costs.

The quantitative results use two elasticities. The parameter \lambda measures proportional liquidity withdrawal in response to a proportional price decline. For a power value function, \gamma measures the proportional value change produced by a proportional liquidity change. The factor \Gamma records the clearing layer’s additional effect on withdrawal-driven value loss. Their formal definitions appear in Section 9. A quadrature rule approximates an integral by a weighted finite sum. Its error matters when a numerical tail-loss estimate sets collateral.

1.4 Relation to the literature

A copula describes the dependence between random outcomes after their individual distributions have been fixed. Loss-versus-rebalancing compares a pool’s value with a strategy that continuously holds the same instantaneous quantities at the external market price. The literature below supplies these comparisons and the institutional framework.

1.5 Organization

The argument begins with the loss entering clearing. Sections 2–5 specify the reserve model, portfolio losses, probability laws, numerical allowances, and continuing model checks. These inputs determine required margin and its retained level when a model fails. Section 6 then fixes the funded account state and allocates losses through the waterfall. It also separates that allocation from legally final settlement and compares accepted transfers with liquidation. Section 7 handles changes in the permitted trading book.

Liquidation can change the next loss calculation. Section 8 bounds that effect through explicit holdings and funding responses. Sections 9–10 introduce the separate model in which withdrawals change the hub asset’s value. Section 11 identifies the settlement discipline that removes its clearing-induced withdrawal channel and evaluates the funded buyback conditions. Section 12 treats losses in the settlement assets themselves. Section 13 states the adversarial bounds under specified strategies. Section 14 evaluates the loss, detection, and funded-execution calculations under declared generators. Section 15 records the remaining problems.

The appendices carry the calculations needed to use those results. Appendix A evaluates the restricted cross-margin formula. Appendix B follows a loss through the appropriate clearing book. Appendix C answers the remaining timing question from the opening example. Its backward recursion computes the exact cash needed to complete a finite plan after every represented observation. The settlement-record argument then explains how that cash condition survives committed payments, repeated reports, and returns under its stated provider and storage assumptions.

2.1 The AMM-CCP market model

We fix the following structure. A central counterparty clears trades for N spoke pools. Each pool trades a spoke asset B_i against a common hub asset M. Pool i has reserves (R_{\!M}^{(i)}, R_{\!B}^{(i)}).

Its constant-function invariant is R_{\!M}^{(i)} \cdot (R_{\!B}^{(i)})^{g_i} = k_i with coupling exponent g_i>0. The case g_i=1 recovers constant-product markets [12, 13]. Every positive exponent defines a power-weighted market, with marginal price P_i=g_iR_{\!M}^{(i)}/R_{\!B}^{(i)}.

The reserve rule fixes how a sale changes both pool balances. Its constant k_i stays fixed within an execution window, while the positive exponent g_i determines the shape of the price response. The marginal price is the price of an additional infinitesimal unit. The average price uses the total proceeds of the actual sale. We distinguish them because collateral recovery uses proceeds and unsold holdings use the recorded accounting price.

3.1 Scenario-based Expected Shortfall

A scenario distribution assigns a probability to each specified market outcome. The margin calculation applies the actual portfolio loss map in each outcome, then averages its worst tail. Offsets between positions therefore enter through their joint losses.

A quadratic formula can replace this scenario calculation only under additional distributional assumptions. A centered return has mean zero. An elliptical joint law gives every linear portfolio the same standardized distribution, with a direction-dependent scale. The next result makes this common projection property explicit, so its scope excludes an arbitrary portfolio of nonlinear payoffs. Here a covariance matrix records variances and pairwise co-movements, while its normalized correlation matrix has unit diagonal.

For a nonlinear payoff, write its loss as an approximating loss plus a remainder. The next bound turns a bound on the remainder’s expected absolute size into an additional tail-loss allowance. A common uncertainty set contains the alternative probability laws being considered for every portfolio.

Some markets compute prices from a differentiable cost of issuing a portfolio. The Hessian is that cost’s matrix of second derivatives and describes local price sensitivity. For the following logarithmic cost, it also has an exact covariance interpretation under the pricing law. That interpretation does not by itself estimate the probabilities of realized future losses.

The weights w_j are positive reference weights on the payoff vectors v_j. At position x, the law Q_x assigns probabilities proportional to w_j\exp(v_j^\top x/b), normalized over j.

For a log-partition cost C_b(x)=b\log\sum_j w_j\exp(v_j^\top x/b), \nabla^2 C_b(x)=b^{-1}\mathop{\mathrm{Cov}}_{Q_x}(v). Here Q_x is the pricing law, v_j is a payoff vector, and b>0 is the liquidity parameter. This identity supplies a pricing covariance feature. Physical forecasting requires a specified map from observations and pricing features to a physical law, as in Definition 4.4. Outside the log-partition class, a Hessian describes local price impact and requires a separate statistical interpretation.

The clearing calculation adds losses, collateral, and numerical allowances. They must refer to the same time, obligations, and currency unit. A numeraire is that common valuation unit. A valuation certificate records the inputs and conversion assumptions used for the calculation.

The factor model attributes part of every return to one common random driver and the rest to its own residual. Under equicorrelation, all distinct pairs have the same correlation. This special case gives a sharp comparison between summed standalone margins and the joint charge. The counterexample in the proposition explains why averaging unequal correlations does not preserve that bound.

3.2 Within-venue effective depth

The same quadratic layer determines how much additional notional the margin system can support. This is effective balance-sheet depth, not displayed AMM reserve depth.

Fix the current portfolio and a further amount of free margin. The question is how much of one additional position the covariance charge permits. The quantity b_i(\mathbf q) below measures how that position co-moves with the existing book. The proof solves the resulting quadratic inequality and bounds its cross term by Cauchy–Schwarz.

3.3 Valid correlation matrices and structural priors

Sample correlations converge slowly for new spoke markets [9]. CCPs mitigate this with structural priors (e.g., sector-based correlation matrices), blended with the sample estimate.

A positive-semidefinite matrix (PSD) gives a nonnegative variance for every portfolio. Choosing individually plausible pairwise correlations can violate that requirement. Shrinkage blends a sample estimate with a structural prior, meaning a matrix based on specified background relationships. The construction below first makes the prior a valid correlation matrix.

3.4 Cross-margining specification: spot, perpetual, and event positions

The portfolio margin framework above treats positions abstractly. In practice the clearinghouse cross-margins across three instrument types (spot, perpetual, and event-linked positions), each with distinct risk profile and hedging relationship to the spoke asset. All offsets below are inputs to one scenario-ES generator; they are not additive credits independent of a positive-semidefinite risk model.

A spot position holds the asset itself. A perpetual position is a derivative exposure without a fixed maturity, whose price can differ from the spot price. That difference is the basis, and its variation leaves risk in an otherwise offsetting pair. An event-linked position pays according to a specified outcome. Cross-margining computes their collateral requirement jointly. Each leg is one component of the combined position.

The basis statistic b_i parametrizes the estimated basis-loss law used in its Expected Shortfall term below. For the power coupling G(E)=E^{\varkappa}, the model supplies the scalar event statistic E, its domain, and the configured exponent \varkappa. The domain and boundary convention must make that real power defined. These are declared calibration inputs. No event-specific coupling or volatility-to-loss fit is estimated here.

The general definition retains the full scenario loss charge. The next formula evaluates its certified linear special case, with equal exposure across spokes and an inactive minimum floor. It separates the saving from within-spoke hedges from the saving due to diversification across spokes.

A pairwise discount can reuse the same hedge twice. The following three-position example shows why the joint charge must govern the total credit.

3.5 Fees, LP profit, and concentrated withdrawal

Additional positions permitted by margin rules can change volume and fees without adding reserves to a pool. The next calculation keeps three comparisons separate: fees per permitted notional, total provider profit, and reserves remaining after withdrawals.

3.6 Impermanent loss and LVR as margin inputs

When LP pool-share positions serve as collateral at the CCP, they underperform a continuously rebalanced reference under ambient volatility at the loss-versus-rebalancing (LVR) rate of Milionis-Moallemi-Roughgarden-Zhang [54]. Liquidation events add discrete divergence loss. The margin computation of §3 must account for both relative losses and for the collateral’s absolute price path. Accepting pool shares as collateral is also the levered configuration of Definition 9.2: liquidating seized shares withdraws locked liquidity, which is the channel the settlement discipline of Definition 11.1 closes. This subsection describes a CCP that has chosen to carry that channel.

A pool share gives its owner a fraction of both reserve balances. Its absolute collateral value depends on the current reserve quantities and prices. The relative-performance calculations below compare that value with a specified benchmark, and each margin adjustment retains its own assumptions.

A continuous semimartingale permits both a drift and stochastic price fluctuations. Its quadratic variation measures the accumulated squared fluctuation used in the following loss rate. The result holds while the pool’s weights stay fixed and arbitrage keeps its price aligned with the external price.

3.7 Scope of the elliptical return model

The elliptical reduction also covers a common Student-t family with finite variance. This family allows heavier tails than a Gaussian law. The tail factor changes each charge, but cancels from the ratio when every linear projection uses the same family.

4.1 Definition and tail-integral form

For a general law, several outcomes can have exactly the same loss at the tail threshold. Such a positive probability at one value is an atom. The formula below includes only the fraction needed to fill the worst tail mass. The auxiliary value v is a candidate loss threshold, and (x)_+ denotes the positive part of x.

A physical law describes how future outcomes occur, while a price law determines how payoffs are valued now. The symbol \mathcal F_t records the information available when the forecast is made. The common uncertainty set below represents the physical laws covered by the stated calibration evidence. Its transport-distance bound measures the expected monetary discrepancy between matched losses under two laws.

A cumulative distribution function (CDF) gives the probability that a loss is at most a specified amount. When losses lie in a bounded interval, a uniform CDF error supplies a simple transport-distance certificate.

4.2 Constructing a price law with an attained optimizer

The margin calculations above distinguish prices from forecasts. A price law itself must still exist under the constraints used to compute it. The next construction chooses a law that satisfies specified average-payoff constraints while balancing cost against distance from a reference law. Relative entropy, written D_{\mathrm{KL}}, measures that distance and is infinite when the required density or integrability fails. A finite-entropy feasible law is therefore a substantive premise. This is an additional pricing mechanism with a separately specified reference law, cost, and moment constraints. The reserve invariant supplies liquidation proceeds. It does not determine these additional pricing inputs.

An indicator payoff can jump at a contractual boundary, so continuity of every constraint would exclude useful contracts. The next result admits bounded measurable payoffs while retaining the reference law’s treatment of boundary probabilities.

For computation, divide the outcome space into cells and choose each cell’s total probability. Within a cell, retain the reference law’s conditional distribution. This construction lifts the finite probability vector to a full outcome law. A feasible candidate gives an upper objective value, and the dual multipliers give a lower value. Their gap bounds the optimizer’s error.

4.3 Quadrature error bound

For numerical evaluation, \mathrm{ES}_q^{\mu_t} is evaluated on a finite quadrature grid \{\omega_j\}_{j=1}^J with weights \{w_j\} satisfying \sum_j w_j = 1. The discretisation error is bounded by standard quadrature theory.

A grid that ignores a payoff jump can miss the loss even when it approximates smooth prices accurately. The next bound charges separately for representing losses within cells and for assigning the wrong probability mass to cells.

4.4 Compatibility with the parametric ES

4.5 Robustness to state-price-density manipulation

The pricing law is an output of a clearing estimator that observes trade flow. A certified contamination model can bound a pricing diagnostic. A physical-margin guarantee additionally needs a stability bound for the induced physical uncertainty sets.

The contamination contract alone does not explain how trades affect an estimated law. For the finite entropy mechanism, the next result connects a bounded change in observed input features to a change in its computed prices. Its constraint set and reference weights stay fixed throughout the comparison.

To propagate that sensitivity into margin, specify how the computed probabilities weight candidate physical laws. The next result controls the resulting sets of monetary loss distributions. Their Hausdorff distance bounds how far any law in either set lies from a matching law in the other.

Here and below, B_t denotes the largest of the floor, stress, and physical-risk requirements at time t. Definition 5.16 gives its formula after the estimator and health checks have been specified.

5.1 Estimator and sample complexity

The estimation bound assumes independent, identically distributed observations, abbreviated i.i.d. A sub-Gaussian assumption bounds exponential moments of centered observations and controls unusually large errors. The Frobenius norm \|\cdot\|_F is the square root of the sum of squared matrix entries. The probability statement below bounds that aggregate correlation error under these assumptions.

5.2 Misspecification-robustness bound

The Gaussian fit matches first and second moments only. Fill streams may carry higher-order dependence, in which case the fit misspecifies the joint distribution. We bound the margin gap this introduces.

5.3 Regime-shift detection and estimator reset

Proposition 5.2 assumes i.i.d. samples. Fill streams may exhibit regime shifts — discrete changes in the underlying correlation structure — that violate the i.i.d. assumption and degrade the estimator. The detector is a standard two-window generalised-likelihood-ratio change-point test.

The detector compares how well one Gaussian model fits both windows against two models fitted separately. A large improvement from the separate fits is evidence against an unchanged regime. A finite-sample guarantee for repeated use requires the additional calibration and total error budget stated after the definition.

Counting false alarms over the life of the monitor requires a statistic that remains valid under repeated inspection. The product below starts at one and has conditional expectation no greater than its preceding value under the stated calibration contract. Such a process is a nonnegative supermartingale. Its threshold crossing supplies the lifetime alarm bound.

5.4 A persistent policy for inspection, reset, and admission

A repeated inspection changes what the operator knows. A reset changes which model it uses. Neither event restores an error allowance that an earlier decision has consumed. We make these distinctions explicit in one policy. The probability arguments use conditional Ville bounds [61] and the prospective union bound of Proposition 11.17. Their role is to permit adaptive operation under stated laws.

An epoch is an interval governed by one registered model and its testing allowance. A predictable quantity is fixed from available information before the next observation. The history keeps three probability allocations distinct: false alarms, failed certificates, and adverse economic outcomes of admitted actions.

5.5 Defense-in-depth against correlation-model failure

The preceding calculations supply different estimates of the collateral needed for the same portfolio. A required minimum, a stressed scenario loss, and a physical loss forecast can each exceed the fitted correlation charge. The policy below collects the largest active requirement. When a health check fails, it also retains the preceding requirement until a recorded recovery decision. This prevents a failed model update from authorizing an immediate collateral release.

6.1 Setup

Let [K]:=\{1,\ldots,K\} index accounts. Account k has outstanding obligation o_k\ge0 and outstanding claim c_k\ge0 for this clearing application. These amounts exclude previously discharged obligations and claims. Let G_k\ge0 be its funded collateral balance in the unit of Definition 3.5. Let h_k^{\mathrm{sen}}\ge0 record prior commitments and encumbrances senior to the current settlement loss. These senior obligations are distinct from the obligations represented in o_k-c_k. Define the available collateral and senior funding deficit by C_k:=(G_k-h_k^{\mathrm{sen}})_+, \qquad D_k^{\mathrm{sen}}:=(h_k^{\mathrm{sen}}-G_k)_+, \qquad G_k+D_k^{\mathrm{sen}}=C_k+h_k^{\mathrm{sen}}. An external debit changes G_k and exposes any deficit without erasing senior commitments. An obligation represented in h_k^{\mathrm{sen}} does not also enter this application’s gross loss. The same perimeter applies to gross claims and any permitted netting. If it later becomes the obligation being settled, its reservation and loss entries transfer together under the governing priority rule. For G_k=100, h_k^{\mathrm{sen}}=30, and a separate current loss L_k=90, Stage 1 draws 70 and leaves 20. If a total obligation of 90 instead includes that senior 30, settle the senior part once before applying the remaining-loss waterfall. After an actual senior payment of 30, the remaining funded balance is 70 and the remaining obligation is 60. Its Stage 1 payment leaves zero residual. Write L_k:=(o_k-c_k)_+ for the current loss before available collateral. An account defaults in this application if L_k>C_k. Thus D:=\{k:L_k>C_k\}, s_k:=\min(L_k,C_k), and r_k:=(L_k-C_k)_+. Senior deficits remain distinct unpaid obligations and are outside this application’s residual. They require the governing priority-specific settlement procedure.

Let E_{\mathrm{SIG}} and \mathrm{IF} be the currently drawable balances of the dedicated CCP and insurance pots. Apply their own senior commitments and legal eligibility before computing these amounts. The member, SIG, insurance, and separate-tier pots contain disjoint funded asset quantities. One asset identifier and quantity can supply at most one pot at the same time. A transfer debits its source before crediting its destination. Noncash collateral contributes only its eligible net settlement proceeds under the stated conversion and timing assumptions. A valuation alone does not supply immediate cash liquidity. All balances, priorities, and conversions belong to one committed calculation snapshot. Let \kappa\in(0,1) be the socialisation cap. Let \mathcal{P}:=\{k:c_k>o_k\}, with profit claim \pi_k:=c_k-o_k. Then \mathcal{P}\cap D=\emptyset.

Cover-k asks whether prefunded resources cover the tested simultaneous defaults of up to k member groups. Affiliated members are grouped for default exposure, while legal netting rights still determine which obligations may be offset. A shared market sale can change several members’ recoveries, so losses must be evaluated in a joint scenario.

The credit test asks whether resources can absorb loss. The liquidity test asks whether the correct currency is available at every payment deadline. The policy below must choose funding actions from information already observed and carry each borrowing’s repayment into later deadlines.

The allocation needs each surviving account’s available balance and contractual contribution limit. Existing senior commitments reduce availability first. Any further reservation must have a stated priority relative to loss collection and socialisation. Socialisation is the allocation of remaining loss to surviving members under those caps.

6.2 Stage structure

The five stages of Definition 6.8 are the following recursion.

Stage 1: Loss settlement and defaulter margin seizure. Deduct senior commitments before calculating C_k=(G_k-h_k^{\mathrm{sen}})_+. The clearinghouse collects s_k=\min(L_k,C_k) from every account with a current gross loss. The accounts with L_k>C_k default, and their remaining shortfall enters the post-collateral waterfall. The AMM-price-impact kernel values any permitted non-settlement collateral. Residual: \Delta_1:=\sum_k(L_k-s_k)_+.

Stage 2: CCP skin-in-the-game. e = \min(\Delta_1, E_{\mathrm{SIG}}) is drawn against the CCP’s dedicated tranche (Definition 6.1). Residual: \Delta_2 := (\Delta_1 - e)_+.

Stage 3: Insurance fund draw. d = \min(\Delta_2, \mathrm{IF}). Each draw atomically consumes the current eligible funded balance. Block-end reconciliation checks the resulting ledger and cannot authorise reuse within the block. Residual: \Delta_3 := (\Delta_2 - d)_+.

Stage 4: Capped socialisation. The target \Delta_3^{\mathrm{soc}} := \min(\Delta_3, \sum_{k \in \mathcal{B}} a_k) is allocated across the socialisation base by the pro-rata rule of Definition 6.8, with the common multiplier chosen to place the target: \ell_k \;=\; \min\bigl(t^*\, w_k,\; a_k\bigr) \ \ (k \in \mathcal{B}), \qquad t^* \;:=\; \inf\Bigl\{t \geq 0 \,:\, \textstyle\sum_{k \in \mathcal{B}} \min(t\, w_k,\, a_k) \geq \Delta_3^{\mathrm{soc}}\Bigr\}. \tag{31} This closed form equals the familiar iterative scheme (allocate pro rata, cap the binders, redistribute over the active set until the residual is placed or every cap binds). Residual: \Delta_4 := \Delta_3 - \sum_k \ell_k.

Stage 5: Auto-deleveraging (ADL). Profitable positions are reduced proportionally to unrealised profit: \delta_k = \pi_k \cdot \min(\Delta_4, \sum_{k' \in \mathcal{P}} \pi_{k'})/\sum_{k' \in \mathcal{P}} \pi_{k'} for k \in \mathcal{P}, with \delta_k = 0 for k \notin \mathcal{P} and for every k when \mathcal{P}= \emptyset, so that no division by zero occurs. The terminal residual is \Delta^{\mathrm{res}} := (\Delta_4 - \sum_{k' \in \mathcal{P}}\pi_{k'})_+.

The recursion has one allocation choice requiring care: capped proportional contributions from surviving accounts. As the common multiplier rises, uncapped accounts contribute more until the required total is met. The next proof establishes that the resulting allocation is unique even when several multiplier values describe fully capped accounts.

6.3 Existence, uniqueness, and order-independence

A calculated zero residual records a complete loss allocation under the fixed inputs. To turn that allocation into discharged obligations, the system also needs a legal netting foundation and evidence of final transfers. Delivery-versus-payment links the release of an asset claim to completion of the corresponding payment.

6.4 Netting foundation and settlement gate

Arithmetic can form a fixed obligation vector under several legal foundations. Their consequences differ. Novation replaces an existing contract with obligations to the central counterparty. An open-offer arrangement makes the central counterparty a party when a qualifying trade is formed under its rules.

(a)

With no netting agreement, the operator uses the gross loss vector.

(b)

An enforceable multilateral netting agreement without interposition can create net obligations among the participants. It does not create a CCP, a skin-in-the-game tranche, a default fund, mutualisation, or auto-deleveraging.

(c)

CCP interposition through novation or open offer makes the CCP the counterparty and supplies the legal basis for the five-stage waterfall.

The arithmetic that forms a fixed vector does not require interposition. The waterfall in this paper does. A claim pack must declare its netting foundation before the operator is applied. Admissible Obligation Transitions defines that declaration and the at-most-once consumption rule for each claim [39]. This paper develops the consequences across claims. The comparison between bilateral and centrally cleared exposure follows Duffie and Zhu [43].

A settlement gate releases matched internal claim transitions only after each required leg presents authenticated completion evidence. Linked delivery-versus-payment makes those internal releases conditional on one another, consistent with PFMI Principle 12 [48]. It does not make independent external systems atomic. It does not give an external leg legal finality or replace its provider’s rulebook. Op: A Typed Bytecode for Compliance-Carrying Operations defines provider finality for each leg [38]. Event-Collect BFT defines ledger confirmation [40]. A unique, order-independent clearing vector can therefore exist before legal discharge. Discharge still requires an enforceable netting basis and final transfers under the applicable systems.

6.5 Porting of client positions

Standard CCP rules permit client positions to move to a surviving member after default (EMIR Art. 48; PFMI Principles 13 and 14 [49, 48]). In the AMM-CCP setting, a client position decomposes into pool-share claims and derivative bookings against surviving counterparties, so porting is structurally more granular than the traditional single-member carry-over.

Porting can avoid an immediate sale by moving an accepted position and its associated obligations to a surviving member. Its benefit depends on what is actually transferred, paid, or discharged. The comparison below therefore gives each candidate route a complete ledger with the same initial claims and deadlines.

Charging a survivor can leave that account unable to meet its next maintenance requirement. The following cascade repeats the waterfall for these newly defaulting accounts while keeping market prices fixed. Each processed account leaves the active set, which supplies the finite bound on the number of rounds.

This discrete cascade is distinct from the continuous price-liquidity feedback of Section 9, which we call the reflexive cascade.

6.6 Stress scenario framework

The cumulative absorption bound of Corollary 6.21 is evaluated against a scenario distribution. PFMI Principle 4 [48] and EMIR Art. 49 [49] require CCPs to stress the waterfall against extreme but plausible events; Definition 6.2 evaluates simultaneous affiliate-group defaults across the recorded joint scenarios. Liquidity has the separate currency and deadline test of Definition 6.6. We fix the minimal scenario template used throughout the paper.

7.1 Instrument tiers and gated pools

A tier is a model label for the book in which the applicable rules permit a position to trade. The Cold, Warm, and Hot labels below distinguish restricted issuance, a restricted trading pool, and the main clearing book. They classify stated eligibility. Their names establish no legal permission on their own.

7.2 Tier-transition recalculation protocol

A margin calculation can remain numerically correct after an operative legal event changes which action is permitted. A dispatch sends an authorized action to its execution provider. The legal-event generation is a counter recording changes to the applicable event state. Checking that counter and committing the action together prevents a decision from using a stale observed rule.

An oracle is the designated source of external prices or event observations used by the calculation. Separate books can still depend on the same oracle, underlying assets, or trading facilities.

8.1 Setup

Consider a first-round liquidation event in which defaulting accounts collectively sell volumes Q_i \geq 0 of spoke asset B_i into pool i for i = 1, \ldots, N. Let P_i(Q_i) denote the realised average price and \Delta P_i(Q_i) := P_i - P_i(Q_i) the slippage. Under Assumption 2.1, for constant-product pools (g_i = 1), \Delta P_i(Q_i) \;=\; P_i \cdot \frac{Q_i}{R_{\!B}^{(i)} + Q_i}. \tag{42} For every fixed g_i>0, with x_i := Q_i/R_{\!B}^{(i)}, the proceeds R_{\!M}^{(i)}[1 - (1 + x_i)^{-g_i}] and the marginal price P_i = g_iR_{\!M}^{(i)}/R_{\!B}^{(i)} give \Delta P_i(Q_i) \;=\; P_i\Bigl(1 - \frac{1 - (1 + x_i)^{-g_i}}{g_i\, x_i}\Bigr) \;=\; P_i\,\frac{g_i + 1}{2}\, x_i\,\bigl(1 + O(x_i)\bigr), which reduces to (42) at g_i = 1 and is increasing in g_i for fixed x_i.

The accounting mark and the average execution price are separate quantities. At cumulative normalized sale x_i=Q_i/R_{\!B}^{(i)}, the terminal marginal-price decline is d_i(x_i)=1-(1+x_i)^{-(g_i+1)}. For constant product, average slippage is x_i/(1+x_i), while terminal decline is 1-(1+x_i)^{-2}. At small size their leading coefficients are one and two. The accounting rule states which terminal or external mark it uses over a fixed horizon h.

The next model follows price declines into account deficiencies and additional sales. Sale volumes are normalized by the initial pool reserves. Holdings determine losses, funded buffers absorb part of them, and a funding policy converts the remaining deficiency into sales. In the expression below, K_h sets accounting marks, A converts their declines into losses, and \mathsf N converts deficiencies into normalized sales.

A fixed point is a cumulative sale vector that requires no further increase under the stated response policy. The coefficient \gamma_h bounds the response to an additional sale in a weighted maximum norm. Below one, successive responses diminish. The theorem converts that condition into an amplification bound.

8.2 Incidence of liquidation slippage

The recovery shortfall and output fee fall on the defaulter’s estate. LPs bear divergence loss relative to holding the original reserves at the final price, and retain the fees. These comparisons use different portfolios. The following identity gives both quantities on the same reserve path.

9.1 Coupled price-liquidity ODE

A proportional price decline induces withdrawals, and those withdrawals feed back into price. The following dimensionless coefficient multiplies the two sensitivities and the clearing layer’s amplification. It measures the strength of this specified feedback at the current state.

In the declining-price regime, substituting Definition 9.1 into (50) and collecting \dot P_M yields the coupled ODE \dot P_M \;=\; \frac{\theta(\bar V - P_M + f(L))}{1 - \varrho}, \qquad \dot L \;=\; \frac{\lambda L}{P_M}\, \dot P_M. \tag{52}

The withdrawal rate reads the same price derivative that it helps determine. We must check whether a proposed derivative satisfies both equations before following it through time. The next proposition lists the consistent choices, including states with more than one choice or none.

9.2 Branchwise local rates near equilibrium

An equilibrium is a state with zero rate of change. Near the equilibrium curve, the rate of return or departure depends on which consistent branch is followed. The theorem states these one-sided rates separately.

9.3 Finite-time collapse on the supercritical branch

The next theorem starts after the declining branch has been selected. Its proof first identifies the curve linking price and liquidity, then shows that the trajectory stays in the declining region. A finite integral bounds the elapsed time to its endpoint. The branch-selection premise remains separate from those conclusions.

9.4 Liquidity concentration and a single provider withdrawal

The withdrawal dynamics of Definition 9.1 treat L(t) as aggregate locked liquidity. When the LP distribution is concentrated, a single LP’s withdrawal moves L discontinuously. Whether such a jump can carry a subcritical state across \Sigma depends on the price response, and the answer separates the levered from the unlevered clearing layer.

10.1 Desingularization

Equation (52) is the constrained system A(x)\,\dot x = F(x) with x = (P_M, L) and \det A(x) = 1 - \varrho(x), so it is singular exactly on \Sigma. Rescale time: ds := dt/(1 - \varrho) on the subcritical sheet \{\varrho< 1\}. This is the standard desingularization of a constrained system at an impasse surface [24, 25]. Multiplying through gives the smooth two-dimensional field \frac{dP_M}{ds} = \theta(\bar V - P_M + f(L)), \qquad \frac{dL}{ds} = \frac{\lambda L}{P_M}\, \theta(\bar V - P_M + f(L)). \tag{56}

The new time coordinate removes the vanishing denominator and permits analysis of the equilibrium geometry. Physical-time continuation through the singular surface still requires the original equations. The matrix denoted A in the Jacobian calculation below is the derivative of the rescaled field. It differs from the constraint matrix used to classify the original system.

10.2 Sotomayor conditions on the desingularized flow

Sotomayor’s theorem [23, Thm. 3.4.1][22, Thm. 3.4] classifies a parametrised equilibrium as a fold if the Jacobian A = D_x F has a simple zero eigenvalue with right null v and left null w^\top, and the following conditions hold:

(S1)

\dim\ker A=1, and every non-zero eigenvalue has non-zero real part.

(S2)

w^\top D_{xx}^2 F(x^*, \mu_0)[v, v] \neq 0.

(S3)

w^\top D_\mu F(x^*, \mu_0) \neq 0 (transversality).

We instantiate on (56). The Jacobian at an equilibrium (P_M^*, L^*) \in \mathcal{E} is A = \begin{pmatrix} -\theta & \theta f'(L^*) \\ (\lambda L^*/P_M^*)(-\theta) & (\lambda L^*/P_M^*)\,\theta f'(L^*) \end{pmatrix}. \tag{57}

10.3 Correct classification: \Sigma is an impasse surface

11.1 The severance theorem

Settlement denomination alone does not establish the behavioral condition in Definition 11.1(c). The next calculation records remaining funding paths when members meet cash calls through redemptions or external sales. Its calibrated response coefficients and horizon specify the additional model being tested.

11.2 Insurance-fund floor under exogenous-first drain priority

Theorem 11.2 is structural: the clearing layer is denominated in S. The waterfall’s drain order is a separate, procedural choice, and it matters: an endogenous-first absorption discipline re-introduces price coupling through the absorption order even under exogenous denomination. We fix the drain order and prove an unconditional pathwise floor on the exogenous tranche and a conditional monotonicity statement for the whole fund under an explicit price assumption.

The buyback considered later can accumulate hub-asset inventory alongside protected settlement cash. That inventory counts at zero toward the stated default-capacity requirement. The following accounting uses the lower of spot price and time-weighted average price (TWAP) to mark it. The draw sequence keeps this inventory separate from the primary cash tranche.

In the operational threshold below, \mathrm{OI} denotes open interest, the outstanding position notional used by the recorded coverage rule. The parameter \rho_{\min} is its required exogenous-cash ratio. It is a policy ratio, distinct from the feedback coefficient \varrho.

11.3 Residual risks and the counter-cyclical buyback

The settlement discipline of Definition 11.1 removes the specified clearing-withdrawal channel. Four residual channels remain: (i) position losses on M-exposed positions, absorbed by the waterfall (Theorem 11.2); (ii) holdings and funding links between spoke assets (bounded by Theorem 8.4); (iii) settlement-asset depeg, correlated or not (Section 12 and Corollary 11.8); (iv) governance misconfiguration (structural, outside the model’s scope).

A counter-cyclical buyback purchases the hub asset with funded cash above the protected coverage target. The hub inventory counts at zero toward default capacity under Definition 11.9. The purchase uses an all-in debit reservation, a current physical-risk decision, and current legal eligibility. The next definition states these conditions and records actual fills and costs.

The protected-cash condition asks whether the purchase preserves funding for obligations. The value certificate asks whether its selected fills and later exits satisfy the chosen return budget under the covered laws. Here \mathcal P_t denotes the covered set of current conditional physical laws for these joint execution outcomes.

The closed-form sufficient bounds below make the gate’s dependence on the underlying risk parameters explicit.

The reserve threshold X limits the cash that a purchase can spend while preserving a stated depeg allowance. The next horizon threshold Y limits the selected action’s adverse-event probability. Their certificates answer different questions and apply together with the execution and value conditions.

This proposition uses \mathrm{IF}=F_t^{\mathrm{mark}} for the total fund value at its fixed pre-action mark. That valuation book is distinct from the eligible funded default capacity denoted by \mathrm{IF} in the waterfall. Every fraction and amount in this reserve-ratio comparison uses the same valuation book. Its notation \operatorname{VaR}_{1-q} uses a confidence-level subscript, meaning the upper quantile at cumulative probability 1-q. This is the quantile denoted \mathrm{VaR}_q under the tail-mass convention in Definition 4.2.

A first-order autoregressive process, abbreviated AR(1), carries part of its current deviation into the next observation and adds an innovation. The next bound controls this persistence over a lag. The prediction result that follows also accounts for uncertainty accumulated while an observation becomes stale.

Here r_s denotes the physical coefficient being forecast for the threshold-one adverse event. It is a scalar forecasting process specified by the following conditional model. Using it to forecast the economic coefficient \varrho_s requires that identification in the calibration certificate.

12.1 Haircut schedule and depeg isolation

In Definition 12.1, C_s denotes asset quantity and multiplication by P_s^{\mathrm{ref}} converts it to the common numeraire. For the following monetary loss bounds, C_s denotes that pre-depeg reference value. The per-asset equity and insurance balances likewise denote pre-depeg values in the same numeraire. Thus each depeg fraction multiplies a monetary exposure exactly once.

12.2 Correlated depegs and the copula bound

Independence is an idealization; banking-crisis, regulatory-action, and custody-failure channels correlate stablecoin depegs. We give a copula-based upper bound.

Each marginal law describes one settlement asset’s depeg magnitude. The copula supplies their dependence after those marginal laws are fixed. Both determine the distribution of the largest simultaneous depeg used in the bound.

13.1 Adversary catalogue

We distinguish four baseline adversary classes used below.

A Sybil strategy divides one controller’s activity among several accounts. The model charges a separate know-your-customer (KYC) identity cost for each account. The classes below distinguish how many accounts, observations, and event outcomes the adversary can control.

13.2 Reflexivity rate-limiter and adaptive-oscillation bound

Theorem 11.2 removes the primary reflexive channel when the clearing layer is denominated in S. An exchange-level control may nonetheless expose a residual reflexive channel through a policy parameter \Phi(t) (for example, an LP-fee tilt or a dynamic haircut) whose movement induces cross-pool liquidity reallocation. We model this residual channel and prove that a rate-limiter on \Phi caps the amplitude of any adaptive adversarial oscillation.

13.3 Gated-buyback manipulation path

Propositions 11.16 and 11.17 bound the funded and physical-risk gates. Proposition 11.19 bounds an auxiliary autocorrelation statistic. A matching manipulation-cost statement needs a complete observation model and the exact reserve-ratio arithmetic. The following model makes both explicit.

This calculation fixes a complete observation model for two diagnostic screens. The symbol \Phi^{-1} below denotes the standard normal quantile function. It is distinct from the policy process \Phi(t) in Section 13.2. Passing these screens leaves the action’s other funding, legal, and physical-risk requirements in force.

13.4 Waterfall attacks

We formalise four attacks against the waterfall of §6.2: hedge-discount leg-removal, synthetic-directional cross-margin, insurance-drain via Sybils, and strategic default. Each is stated with an explicit adversary, payoff bound, and (where possible) matching construction.

13.5 Concurrent defaults in the waterfall

Proposition 6.13 establishes that the waterfall is order-independent under simultaneous defaults when stages are applied level-by-level. We now state the exact loss-absorption limit for one concurrent default set.

13.6 Scope of the adversarial bounds

Table 2 records the adversary model, defence, and bound for each adversarial proposition above, with the classification of the matching construction. Matched means a construction achieves the bound up to the stated constant; one-sided means only the bound is proved.

C.1 Conditional risk and cash at a deadline

Expected Shortfall describes a loss distribution under a specified information set. Repeated decisions require the information structure as well. Recursive risk functionals and their time-consistency properties are established subjects [70]. Here their role is to specify a conditional loss budget alongside the cash needed for completion.

For a fixed plan on a finite probability tree, let \ell(s,z) be the economic loss between adjacent observations. A nested conditional risk value has the form \rho(s)=\mathop{\mathrm{ES}}_{q(s)}\!\left(\ell(s,z)+\rho(z)\mid s\right), \qquad \rho(t)=L(t) \quad\hbox{at a terminal state }t. The conditional probabilities, tail mass q(s), and terminal loss L(t) belong to the specified risk model. A policy can restrict the permitted actions through a recorded budget for these values. Its funding test still accounts for the actual order of receipts and payments. A payment of 100 followed by a receipt of 100 has zero net loss and requires 100 at the earlier deadline.

For a controlled plan, the current state carries a risk budget r(s)\ge0. Each action assigns budgets to its successor states before their outcomes become known. Those budgets accompany the resulting obligations and funding commitments.

An adapted policy chooses each action using only information already observed. Its successor budgets must therefore be assigned before the next outcome is known.

The conditional law in this proposition includes the information used to select the action. An older-information estimate requires a corresponding current conditional certificate before it supplies that law. The budgets constrain future risk choices and supply no cash by themselves.

C.2 Observable states and conserved funding

All cash amounts below use one stable settlement unit. One node represents a history available to the decision maker. Its noncash state records every liability, resource limit, encumbrance, provider condition, and authority condition used by the remaining plan. Unobserved distinctions remain possible outcomes of a common decision. Two histories can share a node when their recorded states permit exactly the same remaining continuations.

The increment g contains delivered receipts less payments at its checkpoint. When receipts fund those payments, the model records their availability before the debit. Any earlier debit requires an earlier checkpoint. An immediate draw therefore precedes the payment it funds through a separate draw node. An enforceable obligation to supply funds and the cash supplied under that obligation remain distinct state entries.

A draw consumes the facility’s remaining limit and creates its repayment liability. Its child state retains that liability until an exact repayment discharges it. Terminal cash m includes every residual repayment, fee, and completion obligation represented by the plan. Each physical receipt contributes once along an executed history. Mutually exclusive histories can use the same undrawn facility, within its stated limit on each history. Concurrent plans sharing that limit require a joint state and one aggregate resource reservation.

Provider failure belongs to the successor set wherever the stress contract requires it. An action that cancels, closes, or transfers a position retains the resulting settlement and recovery obligations. Its action set records the authority and terms that permit that change. These are premises of the finite model. The cash calculation determines what follows from them.

C.3 The exact continuation requirement

The calculation works backward from final payments. Each action needs cash for its immediate debit, its retained floor, and every continuation still possible afterward. The least demanding permitted action determines the current requirement.

For a terminal state, set K(t)=m(t). Define the threshold for action a and the minimum completion cash by backward recursion: \begin{align*} T(s,a)&=d(s,a)+\max\left\{ h(s,a),\max_{z\in Z(s,a)}\bigl[K(z)-g(s,a,z)\bigr]\right\}, \tag{84} \\ K(s)&=\min_{a\in A(s)}T(s,a). \tag{85} \end{align*} The minimum of an empty action set is +\infty. All other input amounts are finite. The value +\infty identifies a state from which finite cash cannot complete the permitted plan.

The outer minimum precedes the maximum over successors because one action must cover every outcome still possible when it is chosen. Interchanging them permits knowledge of a future observation. For example, two actions may each avoid a 100 payment in one outcome and leave it in the other. If either outcome can follow either action, the requirement is 100. Selecting the favorable action after seeing the outcome incorrectly gives zero.

The recursion uses all represented branches, including branches with small positive probability. Replacing its maximum by Expected Shortfall changes the guarantee to a risk-budget statement. The local floor h can include any cash reservation required by the chosen risk policy. A restriction that persists after the next observation remains in the successor state. Cash reserved for one legal claimant becomes available to another only through a permitted transfer.

C.4 Completion with funding after an observation

Removing the later receipt while retaining the repayment raises the draw-route requirement to 105. If a cash-only route exists, its requirement is 100 and the minimum selects that route. Adding a facility-failure branch also raises the root requirement to 100, because that branch still owes the payment. A timely independent backup can reduce this amount according to its own cost, capacity, and repayment terms.

For a conditional plan, the first observation can select between a low-payment state and the funded state of Example C.6. If the low-payment state needs 20, the root requires 40. Only the observed high-payment branch draws the facility. This is an adapted strategy with initial cash below the largest payment. It uses named, timed resources and retains every associated liability.

C.5 Durable completion and retained margin

The graph calculation specifies required cash at decision states. A workflow is one admitted settlement plan with its own payment identities and reserved resources. Its durable record connects graph states to payments and receipts that may arrive later or be reported repeatedly.

The cash recursion supplies an execution rule when observations and payments have distinct arrival times. Between two graph states, cash may await a payment, a dispatched payment may remain uncertain, and an earlier payment may return. The settlement record must retain each of these states.

Fix a permitted policy \pi, which selects one action at every reachable state. Let K_\pi be the recursion (85) on the graph restricted to those actions. Let M\ge0 be an independently retained cash margin, unavailable for the plan’s payments. The floors h in Definition C.3 still apply to the remaining cash.

This decomposition assigns separate functions to M and the cash in the completion problem. A margin already included in the floors or terminal requirements must not be added again. Changing M requires a new current funding check. An increase can produce a shortfall even when the initial admission met the proposition’s bound.

A physical occurrence is one actual provider-reported transfer, distinguished from repeated reports of that transfer. A settlement projection calculates the workflow’s cash from these occurrences and its recorded releases. Holds reserve current cash internally, while external reservations protect commands already prepared for payment.

The durable reference uses one settlement authority and one serializable transaction for the workflow state, holds, commands, and settlement journal. A provider execution lies outside that database transaction. At an ordinary pending stage, its hold covers \max\{0,C_f-E_f\} whenever current funding and authority permit that reservation. A failed reservation records a shortfall while preserving the admitted physical facts. Preparing or dispatching another payment requires cash for its external reservations and the current retained margin. The checks also require the workflow’s graph binding to remain current and its resource reservations to remain funded.

Serializable transactions make concurrent recorded updates equivalent to a sequential order. Durable storage preserves committed updates across restart. Integral settlement quanta express amounts as whole multiples of the smallest permitted settlement unit. The following correspondence relates such committed records to the cash recursion, conditional on the stated external funding and observation facts.

Completion is evaluated using the settlement events admitted so far. A later return preserves the earlier completion receipt as history and places the reopened obligation in recovery. The next payment uses the current unpaid amount after existing reservations. Recovery retains the workflow’s next graph state and its separate obligations. The subtraction of W_f prevents an earlier release from becoming available to that workflow again.

The margin rule retains the preceding requirement during degraded operation, as in Proposition 5.17. A healthy signal alone leaves an existing degraded state in force. A recorded recovery decision can clear that state, and admitted healthy repricing can reduce the margin. Once obligations are discharged and the current margin is zero, the remaining internal hold can be released. These decisions remain inputs from the governing authority.

The correspondence concerns a single authority’s admitted records and transitions. It assumes truthful external facts, available resources, valid permissions, and storage that resists rollback by its operator. Graph stages order the represented deadlines, while real settlement timing requires a corresponding provider contract. An unmodeled outcome or incomplete provider payment leaves completion pending. The integral single-asset implementation and its synthetic provider establish this bounded execution path. Empirical loss laws, calibration, legal facility terms, custody, and live provider performance remain separate evidence requirements.

C.6 Finite reference calculation and scope

The reference calculation uses exact rational cash and a finite deadline order. It validates unique cash occurrences, gross resource limits on each history, retained loan liabilities, exact repayments, and repayment deadlines. Every terminal debt enters the discharge amount. Its conditional-budget profile also checks each action’s conditional probabilities, stage loss, successor budgets, and terminal loss. The budget and cash tests use the same successor states. Mutually exclusive draws share a facility limit, while repeated draws along one history consume that limit cumulatively. An edge credits its receipts before debiting its listed payments at the target checkpoint. The model separates another timing order into further nodes.

Backward cash evaluation takes one pass over the validated action edges. The conditional risk checks sort each action’s finite loss distribution to integrate its exact tail mass. The reference ledger validation enumerates represented histories, which can grow exponentially with the horizon. It uses amounts directly and does not enumerate monetary units. A larger implementation can merge histories when it preserves the complete debt, resource, authority, and observation state.

The finite calculation certifies the supplied graph. Its deployment inputs require current evidence for available cash, draw authority, provider survival, receipt timing, and the complete obligation perimeter. Multiple currencies require separate balances and explicit conversion actions under Definition 6.6. Partial observations require information states that retain every compatible continuation. These extensions preserve the question answered by the theorem: which permitted actions still admit funded completion after every represented observation?